SpringBoot 3迁移Saml2遇Saml2MetadataFilter报错：entityId不能为空

问题描述 #

将Saml2迁移至SpringBoot 3时，服务提供者侧的Saml2MetadataFilter触发异常，尝试两种实例化方式均报错：

尝试的实例化方式 #

• 方式一：

Saml2MetadataFilter filter = new Saml2MetadataFilter(
    (RelyingPartyRegistrationResolver) relyingPartyRegistrationResolver,
    new OpenSamlMetadataResolver());

• 方式二：

Saml2MetadataFilter filter = new Saml2MetadataFilter(
    (RelyingPartyRegistrationRepository) relyingPartyRegistrationResolver,
    new OpenSamlMetadataResolver());

报错信息 #

Caused by: java.lang.IllegalArgumentException: entityId cannot be null or empty

问题原因 #

核心原因是RelyingPartyRegistration实例未配置有效的entityId。Spring Boot 3对Saml2的元数据解析逻辑做了严格校验，服务提供者（SP）自身的entityId为空时，会直接触发该参数异常。

解决步骤 #

1. 确保RelyingPartyRegistration配置完整 #

构建RelyingPartyRegistration时必须显式设置非空的entityId，示例代码：

@Bean
public RelyingPartyRegistrationRepository relyingPartyRegistrationRepository() {
    // 构造服务提供者自身的注册信息
    RelyingPartyRegistration spRegistration = RelyingPartyRegistration.withRegistrationId("sp-reg-id")
            .entityId("https://your-sp-domain.com/saml2/service-provider-metadata") // 必填：SP的entityId
            .assertingPartyDetails(idpDetails -> idpDetails
                    .entityId("https://your-idp-domain.com/metadata") // IDP的entityId
                    .singleSignOnServiceLocation("https://your-idp-domain.com/saml2/sso"))
            .build();
    return new InMemoryRelyingPartyRegistrationRepository(spRegistration);
}

2. 正确实例化Saml2MetadataFilter #

无需强行类型转换，直接注入配置好的RelyingPartyRegistrationRepository来构造过滤器：

@Bean
public FilterRegistrationBean<Saml2MetadataFilter> saml2MetadataFilter(RelyingPartyRegistrationRepository registrationRepository) {
    Saml2MetadataFilter metadataFilter = new Saml2MetadataFilter(registrationRepository, new OpenSamlMetadataResolver());
    FilterRegistrationBean<Saml2MetadataFilter> filterBean = new FilterRegistrationBean<>(metadataFilter);
    filterBean.setOrder(1); // 根据实际需求调整过滤器执行顺序
    return filterBean;
}

3. 校验依赖兼容性 #

确保使用与Spring Boot 3匹配的Spring Security SAML2依赖，推荐通过Spring Boot Starter引入：

<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-security</artifactId>
    </dependency>
    <dependency>
        <groupId>org.springframework.security</groupId>
        <artifactId>spring-security-saml2-service-provider</artifactId>
    </dependency>
</dependencies>

内容的提问来源于stack exchange，提问作者Klee